TL;DR: What is the PHP issue, and why are websites down?
The PHP issue is a pair of flaws in PHP, the language behind WordPress and most of the web, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both let an attacker run code on a server without logging in. Because the details leaked early and PHP says no setting fully protects you, many operators switched services off until they could patch: Pokémon HOME, Pokémon Champions and Pokémon Sleep, Cygames titles such as Umamusume, Wikimedia's support tools and government sites in at least seven European countries. None of them has reported a break-in. Founders should patch today, and switch off any PHP site that can't be patched yet.
Developing story. Last updated 22 Oct 2026, 11:30 CEST. We'll update this article as PHP, the security firms and the operators that went offline publish more.
The PHP issue is why your favourite game, your city council's website and Wikipedia's tools went dark this week. "PHP issue" jumped to more than 20,000 Google searches in the US overnight, next to "websites down" and "Pokémon apps offline", and in France, the Netherlands and Germany people search for the same story in their own words.
We broke down the flaws themselves yesterday in our PHP vulnerability news and patch guide. This article covers what happened next: who went offline, why companies with big security teams chose to switch off, whether attacks are happening, and how you decide if your own startup site should go dark for a few hours.
What is the PHP issue everyone is searching for?
On 20 October 2026, PHP announced an emergency release, and on 21 October at 14:00 UTC it shipped the fix. PHP's security advisory names two bugs, both rated 9.2 out of 10 on CVSS v4.0 (the Common Vulnerability Scoring System):
- CVE-2026-109618, "RCE via OOM corruption": a crash path while PHP parses multipart requests (file uploads and forms) when memory runs out;
- CVE-2026-109619, "RCE via stale global state": internal data that PHP keeps using after its memory was freed, reachable through session upload progress, which is on by default.
RCE means remote code execution: an attacker sends a request and runs commands on your server. Researchers nicknamed the pair php2shell. The cloud security firm Wiz says it found the first bug on 19 August, reported it to PHP on 24 August, and showed takeovers of WordPress, Drupal and Joomla without a login.
Here's the detail that explains the shutdowns. PHP writes that there are no complete mitigations, so updating is the only safe choice. When the fix is the only protection and you can't install it within the hour, switching the service off is the one move left.
Which websites and apps went offline because of PHP?
The list grew all through 21 October. Every operator we could check described its shutdown as a precaution, and none has reported a confirmed compromise so far.
Sources: Japanese gaming press (Famitsu on Cygames, which cited "system safety"), the Wikimedia Foundation's own status post, a Reuters factbox, and RTÉ for Denmark. Wikimedia wrote that it deliberately took many supporting services offline until they can be safely patched, and warned that the wikis themselves may see outages.
Some lists online also name Steam, GOG and Nintendo. We found those in a single outlet each, and Nintendo hasn't linked its maintenance to PHP, so treat them as unconfirmed.
Is php2shell being exploited right now?
Security firms disagree on how far attacks have gone, and the difference matters for how fast you move. Here is where each source stood on 21 and 22 October:
watchTowr is the most alarmed, while Cloudflare reports attack traffic without a confirmed success. CISA's Known Exploited Vulnerabilities (KEV) list is the US government's register of bugs with proof of real attacks, and it hadn't added these two by the 21 October update. So attackers are clearly trying, and nobody has publicly confirmed a successful break-in. That gap is exactly why so many teams went offline: they didn't want to be the first confirmed victim.
One more warning from Tenable: code shared online as a php2shell "proof of concept" is unverified and may carry malware. Don't run it to test your own site.
Why did companies with big security teams switch off instead of patching?
Patching a game backend or a government portal takes more than one command. Teams have to find every server and container that runs PHP, including copies bundled inside other products, test the new build, roll it out and restart workers. That takes hours or days.
Three facts made those hours dangerous. The flaws leaked before hosts and Linux distributions had their packages ready. The attack can fire before any application code runs, so app-level defences don't stop it. And PHP's own interim settings (a lower post_max_size, turning off session upload progress, and others) don't make a site safe, according to the advisory.
So the risk maths was simple. A few hours of maintenance costs some angry players and support tickets. A server takeover costs user data, regulator reports and weeks of cleanup. Pokémon, Cygames and governments picked the cheap loss.
Should your startup take its website offline because of PHP?
Most founders don't need to. Many hosts patched fast: GoDaddy, for one, said on 21 October that every PHP version on its Managed WordPress plans was patched and customers needed to do nothing. Ubuntu shipped fixed packages on 21 October, and Debian has fixed packages for its two current releases. Hosted builders such as Tilda, Wix and Shopify run their own platforms, so their customers don't install PHP updates themselves.
Going offline makes sense when patching today isn't possible. Use this split:
PHP 8.1 and older gets no official release. Minimal source backports exist for 7.4, 8.0 and 8.1, and some distributions and hosts ship them. If nobody has applied one to your server, that site stays exposed until it moves to a supported version.
How do you take a PHP site offline safely?
WordPress and Magento maintenance modes don't help here, because the bug triggers while PHP reads the request, before WordPress even starts. You have to stop requests before they reach PHP.
- Block at the edge. On Cloudflare, a rule that serves a static page or blocks traffic to the site works. On your own server, point the virtual host to a plain HTML folder, or stop PHP-FPM and serve a static page. Ask your host to do it if you're on shared hosting.
- Keep the notice static. One HTML file with your logo, a sentence on what's happening and an email address. No PHP, no forms.
- Say what's happening. Pokémon and Cygames left players guessing about return times, and the gaming press filled the gap. A two-line update on your status page, newsletter and social accounts stops the rumours.
- Patch, then verify. Install the fixed release or your distribution's package, run php -v to confirm the version, and restart every PHP worker, so no old code stays in memory.
- Check before you reopen. Look for files changed in the last days, new admin users and odd uploads. If anything looks wrong, keep the site closed and get help.
Here's a message you can copy for customers: "We've taken our site offline for a few hours to install an urgent security update for PHP, the software it runs on. Your data is safe and no attack has been detected. We expect to be back by [time], and you can reach us at [email] meanwhile." Only say "no attack has been detected" after you've checked your logs.
What does the PHP issue mean for you?
- Find every PHP site you own today. That includes old landing pages, staging copies and the forum nobody uses. The Ogi Networks breach started with a test account left behind for 12 years, and forgotten systems are where attackers start.
- Get a written yes from each host. Ask: is the PHP security release from 21 October installed on my plan? Save the reply.
- Switch off what you can't patch. A site that is offline for a day costs you less than a site that serves malware to your customers and gets flagged by Google.
- Put a firewall in front of everything. Cloudflare says its free plan includes rules for these flaws. That buys time and stays a stopgap.
- Write a one-page shutdown plan. Who can switch the site off, how, and what you tell customers. Keep it with your back-office stack notes. This week it was PHP; last week the Revolut outage showed how one supplier failure stops a business.
- Plan the move off old PHP. PHP 8.2 loses security support on 31 December 2026, so anything on 8.2 or older needs an upgrade date in the calendar.
If you're building your first security habits, start with our guide on how to build security into a startup, and follow the month's incidents in our cybersecurity news for October 2026.
Are you getting customers from ChatGPT yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
What we know so far
- 19 to 24 August 2026: Wiz finds the first bug and reports it to PHP.
- 20 October: PHP announces an emergency release after details leak.
- 21 October, 03:02 UTC: Cloudflare's firewall rules go live for all plans.
- 21 October, 14:00 UTC: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 21 October: Ubuntu ships fixed packages; GoDaddy says Managed WordPress is patched.
- 21 October: Pokémon, Cygames, Wikimedia and government sites across Europe go offline as a precaution; watchTowr reports exploitation attempts.
- 22 October, morning: Pokémon Champions, Umamusume, Shadowverse, pixiv and BOOTH are reported back online.
What we don't know yet
- When Pokémon HOME and Pokémon Sleep return, and whether The Pokémon Company will explain the shutdown.
- Whether any company or government confirms a successful break-in through these flaws.
- Whether CISA adds the two CVEs to its Known Exploited Vulnerabilities list.
- How many hosts still run unpatched PHP, especially on PHP 8.1 and older.
- PHP vulnerability: the news, the fixed versions and the patch plan (mean.ceo)
- A no-developer plan for small business websites (Fe/male Switch Foundation)
- A 24-hour plan for freelancers who look after client sites (Fe/male Switch)
- What engineering teams must patch to protect portals and CAD files (CADChain)
Running one small business website with no developer? Use the Fe/male Switch Foundation's no-developer plan. Looking after client sites? femaleswitch.com has a 24-hour plan for freelancers, and engineering teams can follow CADChain's checklist for portals that hold CAD files.
FAQ: the PHP issue and the websites that went offline
Why are so many websites down because of PHP?
Two flaws in PHP, fixed on 21 October 2026, let attackers run code on servers without logging in. PHP says no setting fully protects you, so operators that couldn't patch at once, such as Pokémon, Cygames, Wikimedia and several European governments, took services offline as a precaution.
Were Pokémon HOME and the other services hacked?
No operator has reported a compromise. The shutdowns were described as precautions, and Cygames cited system safety. Pokémon Champions was reported back online on 22 October; HOME and Sleep hadn't been confirmed back at that time.
Is the PHP vulnerability being exploited?
watchTowr reports exploitation attempts and Cloudflare sees attack traffic, but no successful attack has been publicly confirmed, Huntress saw none on its partners' systems, and CISA hadn't listed the flaws as known exploited by 21 October.
Which PHP version fixes the issue?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official release, only minimal source backports for 7.4, 8.0 and 8.1 that distributions and hosts may ship.
Should I take my WordPress site offline?
Only if it can't be patched today. If your host confirms the fixed PHP is installed, stay online. If you run PHP 8.1 or older with no backport, or nobody can update the server, block traffic before it reaches PHP until it's fixed. WordPress maintenance mode doesn't protect you.
Is my Tilda, Wix or Shopify site affected?
Hosted builders run their own servers and handle updates themselves, so you don't install PHP. If your site also uses a separate WordPress blog or a custom PHP tool, check those with their host.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
